Twitter Report: CovPass shows certificate as valid for entry to France, altough it‘s not valid

[Ein-Tim]

Avoid duplicates

• Bug is not mentioned in the FAQ
• Bug is not already reported in another issue (CWA: Twitter Report: CWA show 3/3 certificate as invalid for entry to France, CovPass shows valid corona-warn-app/cwa-app-ios#3935)

Technical details

• Device name: Not relevant
• iOS version: 15.1.1
• App version: 1.13.0

Describe the bug

CovPass shows a 3/3 vaccination certificate as valid for the entry of France, CWA shows it as invalid.

CWA	CovPass

The rule which failed in CWA is:
"With Moderna vaccine, a finished vaccination course is considered protective earliest from 28 days after the date of the last vaccination."

@thomasaugsten confirmed in corona-warn-app/cwa-app-ios#3935 (comment) that this is an issue with CovPass.

Steps to reproduce the issue

1. Add a Booster certificate to your CWA and your CovPass
2. Check the validity for France
3. See that CWA shows invalid, CovPass shows valid

Note: It seems like this only happens for 6 days after the vaccination in the CWA.

Expected behaviour

CWA and CovPass should show the same result.

Additional context

Link to Twitter: https://twitter.com/diluvium76/status/1467126523618643968?s=20

[alexcimander]

Hi @Ein-Tim,

first of all there are no rules for france that differ between booster or "simple" vaccinations. There is only one rule which states "Vaccination doses must be equal or greater than expected doses". With that a 3/3, 2/2, 1/1 and also 2/1, 3/1 etc. are accepted.

So the "issue" cannot be linked to a booster.

However, looking at the rules of france we saw that they have several rules which deal with the "used" vaccine.
In summary they say: J&J vaccines are valid after 28 days, all others after 7 days.

Now you might wonder: How does that fit to the error message within CWA?

"With Moderna vaccine, a finished vaccination course is considered protective earliest from 28 days after the date of the last vaccination."

Well the answer is sadly: it is a typo within the translation.

  "lang": "en",

  "desc": "With Moderna vaccine, a finished vaccination course is considered protective earliest from 28 days after the date of the last vaccination."

},

{

  "lang": "fr",

  "desc": "Avec le vaccin Moderna, un parcours vaccinale terminé est concideré comme protecteur au plus tôt à partir de 7 jours apres la date de la derniere injection."

}

`
And looking at the logic within the rule we see that the rule checks if the vaccination shot was made at least 7 days ago.

So from a technical point of view our app is behaving the way it should behave. The question is: Were all rules within the CovPass and the CWA up to date? The translation gives a small hint that the rule might have changed (28 to 7 days).

So after this analysis I would kindly ask you (and Markus of course) to give it another try with an updated ruleset?

Thank you for your help here 👍 We appreciate it!

[alexcimander]

And of course it would be important to check the date of the vaccination, the vaccine and the date of check :-)

[Ein-Tim]

Hi @alexcimander

Thanks for your long and detailed comment!

So the "issue" cannot be linked to a booster.

Okay yes, agreed!

That the typo is in the translation is very bad, but nothing in scope to fix for you! So yes, I understand how this actually happened.

But I don't understand your comment:

So from a technical point of view our app is behaving the way it should behave.

This is obviously not true, as the CovPass app displays valid, which is not true for a check on 04.12.2021 when checking a vaccination certificate, which certifies a vaccination from 03.12.2021. Or am I missing something here?

And of course it would be important to check the date of the vaccination, the vaccine and the date of check :-)

For sure:
Date of vaccination: 03.12.2021, date of check (as visible in the screenshots in the OP): 04.12.2021 and vaccine is Moderna

[alexcimander]

@Ein-Tim aha! Sorry I wasn't aware of the date of vaccination (or I just did not see it 😢).
Okay so this seems odd. Before we dive into a deeper analysis. Is the certificate stored in CWA and CovPass the same certificate?
I know you asked that Marcus as well but we could not reproduce it. we tested all vaccinations with a 3/3. The results were:

Before 7 days = all red
After 7. day = all green except J&J
After 28. day = all green

That is why I'm asking once more.

Thank you for your help and patience 👍 :

[Ein-Tim]

@alexcimander

No problem, this was my fault, I didn't include the vaccination date in the OP, sorry.

Okay so this seems odd. Before we dive into a deeper analysis. Is the certificate stored in CWA and CovPass the same certificate?

I asked on Twitter & he confirmed that the certificates have the same UCID (Unique Certificate Identifier). He also removed all other certificates stored and still seed the problem described in the OP.
CWA correctly shows failed, CovPass shows valid.

In the past we saw that very minor issues (like one whitspace too much) can be the cause for different results (see e.g. corona-warn-app/cwa-app-android#4344).
Maybe something similar is happening here?

[timokoenig]

Well this is a problem but as far as I can see it, this works as expected for CovPass (I'm still wondering why CWA shows a different result though). The problem with the rule engine and the vaccination certificate is, that the vaccination date does not include the time. Therefore if you got vaccinated on 01.01. at 23:00 the certificate shows only the date and makes it 01.01. at 00:00.

Example:
Vaccinated 01.01 23:00
Should be valid on 08.01 23:00
Is valid on 08.01 00:00 (which is almost a day earlier depending on the actual vaccination time)

This was a major problem with the initial 14 day rule in Germany and to fix that issue we adjusted the rule to add 15 days so that we have at least 14 days after a complete vaccination. The rule can be found here https://distribution.dcc-rules.de/rules/DE/f19e4792aeaffc8aba2ad59a851cbd3ceea6c0f44cafdb31cbeea6a6dcc7610e

@alexcimander I guess this issue is somehow connected to that.

[Ein-Tim]

Hi Timo @timokoenig

Thanks for joining here!

Well this is a problem but as far as I can see it, this works as expected for CovPass (I'm still wondering why CWA shows a different result though).

Mh, but why is it the expected behavior for CovPass to show a vaccination certificate as valid although it's not?

@thomasaugsten reasonably clarified why CWA behavior is correct and the one from CovPass is wrong. Let's put it like this: Both can't be right and with the rules in place from France, I rather think CWA is right.

The problem with the rule engine and the vaccination certificate is, that the vaccination date does not include the time.

I know, but how is this related here? The Twitter user was vaccinated on 03.12.2021 and checked on the very next day. Independent of any exact time, a valid result can't be right here, or am I mistaken?

[timokoenig]

@Ein-Tim I might have mixed something up. I got confused with the statement in the original ticket that this only happens 6 days after the vaccination which could be related to the date time issue I mentioned above. If this also happens on the day after the vaccination then something else is definitely wrong here. I will think about it

[Ein-Tim]

@timokoenig

Oh my fault, sorry, this was a bad formulation! It only happens up to 6 days after the vaccination (which is in consistency with the French rule).

Sorry 😕

[timokoenig]

@Ein-Tim I know where the issue is and why we have a difference between CWA and CovPass.

CWA checks against one specific certificate, in this case the 3/3
CovPass checks against all available certificates for that one user and selects the first certificate that is valid to enter the country (FR), in this case the 2/2. It is not very transparent what is happening under the hood and should be more clear to the user. This definitely leads to confusion. @alexcimander could you put this on your list for things to fix? Thanks 🙏🏼

[Ein-Tim]

@timokoenig

Ah okay, makes sense.

The user confirmed this!

[timokoenig]

Thanks for clarifying!

[Ein-Tim]

I was just able to reproduce this issue by myself! It's exactly as @timokoenig says.

Enjoy Saturday!

[uwemock]

I get the impression that some people in this discussion believe that there is a general 7-day-rule for all types of vaccinations in France. This is not the case. If the vaccination is someones third dose, the certificate is valid immediately. (It would be ridiculous to take away the "fully vaccinated" status just because you received another jab).

Source:
https://solidarites-sante.gouv.fr/grands-dossiers/vaccin-covid-19/je-suis-un-particulier/dose-de-rappel-covid19

"Toutes les personnes qui font leur rappel disposeront d’un nouveau QR Code, qui deviendra valide 7 jours après leur injection s’il s’agit d’une deuxième dose, ou immédiatement s’il s’agit d’une 3e dose ou plus."

[Ein-Tim]

@uwemock

As this is a technical repository, we're talking about the technical rules here. France has the business rule in place that any vaccination is only valid after 7 days (including booster).

France has to change their business rules to reflect what the official rule, written on https://solidarites-sante.gouv.fr/grands-dossiers/vaccin-covid-19/je-suis-un-particulier/dose-de-rappel-covid19, is.

[uwemock]

In that case, CWA and CovPass should recommend not to scan a booster QR code during 7 days after the jab because people would get the (false) impression not to be "fully vaccinated" in France.

[Ein-Tim]

@uwemock Not too sure whether a drastic recommendation like this is really needed, only a very small percentage of the people adding a booster certificate to their app will travel to the France directly afterwards.

I rather recommend that this issue is transferred to the responsible French team and they fix it.

[uwemock]

Well, relying on others to fix this means we'll have apps that give results that don't comply with the official rules in the meantime.

And again: This confuses people! This is how rumours are started. A friend of mine talked to me after her booster jab that she was afraid of losing her "fully vaccinated" status for two weeks when she scans the certificate. Articles on social media had spread the word. Therefore, communication about such issues should be very clear, or else the apps will lose credibility and trust.

[timokoenig]

You are right, this needs to be communicated better but if the rules of France are wrong then only they can fix it. Germany can not change the official business rules of other countries that are being provided by them.

[Ein-Tim]

I think the rules of France where fixed in the meantime, or @timokoenig?

[timokoenig]

At least the translation has not been fixed yet. Still a difference between EN and FR

https://timokoenig.github.io/eu-dcc-rules/?ruleset=eu-dcc-rules&country=FR&rule=VR-FR-0005

[Ein-Tim]

This issue has become stale and obsolete. Thus closing.